Prototype pollution in DOMPurify - CVE-2024-45801

Vulnerability identifier: #VU97758

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45801

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in XSS attack.

DOMPurify
Network Observability plugin for the Openshift Console
SUSE Manager Server 5.0
SUSE Manager Retail Branch Server 5.0
SUSE Manager Proxy 5.0
SUSE Linux Enterprise Micro
IBM Cloud Pak for Security
Cryostat
Splunk DB Connect
Jira Service Management Data Center
Jira Service Management Server
Bitbucket Data Center
Jira Software Data Center
Confluence Data Center
Bamboo Data Center
IBM Process Mining
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Dev Spaces
QRadar User Behavior Analytics
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
IBM Sterling Connect:Direct Web Services
IBM Observability with Instana
QRadar Suite
IBM Security SOAR
Oracle Utilities Application Framework
Web Help Desk
Splunk Machine Learning Toolkit
Storage Ceph
Rational Developer for i
Storage Defender – Data Protect
QRadar Log Source Management App
Jazz Reporting Service
Jira Software Server
mermaid
Oracle Application Express
receptor (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
ansible-core (Red Hat package)
automation-controller (Red Hat package)
suse-manager-5.0-s390x-server-hub-xmlrpc-api-image
suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image
suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image
suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image
suse-manager-5.0-aarch64-server-attestation-image
suse-manager-5.0-x86_64-server-attestation-image
suse-manager-5.0-ppc64le-server-attestation-image
suse-manager-5.0-s390x-server-attestation-image
suse-manager-5.0-s390x-proxy-ssh-image
suse-manager-5.0-aarch64-proxy-tftpd-image
suse-manager-5.0-aarch64-proxy-squid-image
suse-manager-5.0-s390x-proxy-tftpd-image
suse-manager-5.0-aarch64-proxy-ssh-image
suse-manager-5.0-s390x-proxy-squid-image
suse-manager-5.0-x86_64-proxy-squid-image
suse-manager-5.0-ppc64le-proxy-ssh-image
suse-manager-5.0-x86_64-proxy-tftpd-image
suse-manager-5.0-x86_64-proxy-ssh-image
suse-manager-5.0-ppc64le-proxy-squid-image
suse-manager-5.0-ppc64le-proxy-tftpd-image
suse-manager-5.0-ppc64le-server-migration-14-16-image
suse-manager-5.0-s390x-server-migration-14-16-image
suse-manager-5.0-aarch64-server-migration-14-16-image
suse-manager-5.0-x86_64-server-migration-14-16-image
suse-manager-5.0-s390x-proxy-httpd-image
suse-manager-5.0-x86_64-proxy-httpd-image
suse-manager-5.0-aarch64-proxy-httpd-image
suse-manager-5.0-ppc64le-proxy-httpd-image
suse-manager-5.0-aarch64-proxy-salt-broker-image
suse-manager-5.0-ppc64le-proxy-salt-broker-image
suse-manager-5.0-s390x-proxy-salt-broker-image
suse-manager-5.0-x86_64-proxy-salt-broker-image
suse-manager-5.0-s390x-server-image
suse-manager-5.0-ppc64le-server-image
suse-manager-5.0-aarch64-server-image
suse-manager-5.0-x86_64-server-image
Red Hat OpenShift Container Platform

Install update from vendor's website.

DOMPurify - addressed in versions 2.5.4, 3.1.3
QRadar Suite - update to 1.10.27.0
Splunk DB Connect - update to 4.0.0
Jira Service Management Data Center - addressed in versions 5.4.28, 5.12.15, 5.17.4, 10.3.16, 11.3.0
Jira Service Management Server - addressed in versions 5.4.28, 5.12.15, 5.17.4, 10.3.16, 11.3.0
Splunk Machine Learning Toolkit - update to 5.5.0
Storage Ceph - update to 8.1
Jazz Reporting Service - addressed in versions 7.0.3 iFix023, 7.1 iFix011, 7.2 iFix003
Bitbucket Data Center - addressed in versions 9.4.18, 10.2.2
Jira Software Server - addressed in versions 9.4.28, 9.12.15, 9.17.4, 10.1.1, 10.3.16, 11.3.0
Jira Software Data Center - addressed in versions 9.4.28, 9.12.15, 9.17.4, 10.1.1, 10.3.16, 11.3.0
Confluence Data Center - addressed in versions 9.2.17, 10.2.7
Bamboo Data Center - addressed in versions 10.2.18, 12.1.6
mermaid - addressed in versions 10.9.3, 11.0.0
Web Help Desk - update to 12.8.4
receptor (Red Hat package) - addressed in versions 1.5.1-1.el8ap, 1.5.1-1.el9ap
Network Observability plugin for the Openshift Console - update to 1.7.0
IBM Process Mining - update to 1.15.0 IF003
Storage Defender – Data Protect - update to 2.0.11.1
Ansible Automation Platform - update to 2.4
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-8.el8ap, 2.4-8.el9ap
Red Hat Advanced Cluster Management for Kubernetes - update to 2.11.4
ansible-core (Red Hat package) - addressed in versions 2.15.13-1.el8ap, 2.15.13-1.el9ap
Red Hat OpenShift Dev Spaces - update to 3.18.0
QRadar User Behavior Analytics - update to 4.1.17
automation-controller (Red Hat package) - addressed in versions 4.5.13-1.el8ap, 4.5.13-1.el9ap
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.8
Red Hat OpenShift Container Platform - update to 4.18.10
suse-manager-5.0-s390x-server-hub-xmlrpc-api-image - update to 5.0.3-6.9.5
suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image - update to 5.0.3-6.9.5
suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image - update to 5.0.3-6.9.5
suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image - update to 5.0.3-6.9.5
suse-manager-5.0-aarch64-server-attestation-image - update to 5.0.3-6.9.10
suse-manager-5.0-x86_64-server-attestation-image - update to 5.0.3-6.9.10
suse-manager-5.0-ppc64le-server-attestation-image - update to 5.0.3-6.9.10
suse-manager-5.0-s390x-server-attestation-image - update to 5.0.3-6.9.10
suse-manager-5.0-s390x-proxy-ssh-image - update to 5.0.3-7.9.6
suse-manager-5.0-aarch64-proxy-tftpd-image - update to 5.0.3-7.9.6
suse-manager-5.0-aarch64-proxy-squid-image - update to 5.0.3-7.9.6
suse-manager-5.0-s390x-proxy-tftpd-image - update to 5.0.3-7.9.6
suse-manager-5.0-aarch64-proxy-ssh-image - update to 5.0.3-7.9.6
suse-manager-5.0-s390x-proxy-squid-image - update to 5.0.3-7.9.6
suse-manager-5.0-x86_64-proxy-squid-image - update to 5.0.3-7.9.6
suse-manager-5.0-ppc64le-proxy-ssh-image - update to 5.0.3-7.9.6
suse-manager-5.0-x86_64-proxy-tftpd-image - update to 5.0.3-7.9.6
suse-manager-5.0-x86_64-proxy-ssh-image - update to 5.0.3-7.9.6
suse-manager-5.0-ppc64le-proxy-squid-image - update to 5.0.3-7.9.6
suse-manager-5.0-ppc64le-proxy-tftpd-image - update to 5.0.3-7.9.6
suse-manager-5.0-ppc64le-server-migration-14-16-image - update to 5.0.3-7.9.7
suse-manager-5.0-s390x-server-migration-14-16-image - update to 5.0.3-7.9.7
suse-manager-5.0-aarch64-server-migration-14-16-image - update to 5.0.3-7.9.7
suse-manager-5.0-x86_64-server-migration-14-16-image - update to 5.0.3-7.9.7
suse-manager-5.0-s390x-proxy-httpd-image - update to 5.0.3-7.9.12
suse-manager-5.0-x86_64-proxy-httpd-image - update to 5.0.3-7.9.12
suse-manager-5.0-aarch64-proxy-httpd-image - update to 5.0.3-7.9.12
suse-manager-5.0-ppc64le-proxy-httpd-image - update to 5.0.3-7.9.12
suse-manager-5.0-aarch64-proxy-salt-broker-image - update to 5.0.3-7.9.14
suse-manager-5.0-ppc64le-proxy-salt-broker-image - update to 5.0.3-7.9.14
suse-manager-5.0-s390x-proxy-salt-broker-image - update to 5.0.3-7.9.14
suse-manager-5.0-x86_64-proxy-salt-broker-image - update to 5.0.3-7.9.14
suse-manager-5.0-s390x-server-image - update to 5.0.3-7.11.12
suse-manager-5.0-ppc64le-server-image - update to 5.0.3-7.11.12
suse-manager-5.0-aarch64-server-image - update to 5.0.3-7.11.12
suse-manager-5.0-x86_64-server-image - update to 5.0.3-7.11.12
OpenShift Logging - update to 5.9.7
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.26, 6.2.0.25, 6.3.0.11
QRadar Log Source Management App - update to 7.0.11
IBM Security SOAR - update to 51.0.4.0
IBM Observability with Instana - update to 285

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674
• https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21
• https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf

• Prototype polution in DOMPurify
• Multiple vulnerabilities in OpenShift Logging 5.9
• Multiple vulnerabilities in Red Hat build of Cryostat 3 on RHEL 8
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Oracle Application Express
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.7
• Multiple vulnerabilities in QRadar Suite Software
• Jira Core Data Center and Server update for DOMPurify
• Jira Service Management Data Center and Server update for DOMPurify
• IBM Security SOAR update for DOMPurify
• IBM Sterling Connect:Direct Web Services update for DOMPurify
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Splunk Machine Learning Toolkit update for third-party libraries
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in SolarWinds Web Help Desk
• Multiple vulnerabilities in IBM Rational Developer for i
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Prototype pollution in Oracle Utilities Application Framework
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.18
• IBM Watson Assistant for IBM Cloud Pak for Data update for DOMPurify
• SUSE update for Maintenance update for SUSE Manager 5.0: Server, Proxy and Retail Branch Server
• IBM Storage Defender - Data Protect update for DOMPurify
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Splunk DB Connect update for third-party components
• Splunk DB Connect update for third-party components
• IBM Storage Ceph update for DOMPurify
• Jira Software Data Center and Server update for dompurify
• Bamboo Data Center update for dompurify
• Mermaid update for DOMPurify
• Confluence Data Center update for dompurify
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in IBM Jazz Reporting Service